Merge branch 'fix-kptr-dtor-deadlock'

Browse source

Kumar Kartikeya Dwivedi says:

====================
Fix kptr dtor deadlock

Referenced kptr destruction can run from tracing/NMI contexts through
bpf_obj_drop() and map value update/delete paths, reaching NMI-unsafe
special field teardown and deadlocks. Justin reported the issue and
iterated on fixes in [0]-[2], and also confirmed the bpf_obj_drop()
reproducer in [3].

This series rejects unsafe obj drops from non-iterator tracing programs,
limits map value recycle to NMI-safe field cancellation, and adds
focused selftests for the obj_drop(), NMI delete, and recycle teardown
cases.

See patches for details.

  [0]: https://lore.kernel.org/bpf/20260505150851.3090688-1-utilityemal77@gmail.com
  [1]: https://lore.kernel.org/bpf/20260507175453.1140400-1-utilityemal77@gmail.com
  [2]: https://lore.kernel.org/bpf/20260519011450.1144935-1-utilityemal77@gmail.com
  [3]: https://lore.kernel.org/bpf/agyG3eQwgmoJwmj2@suesslenovo

Changelog:
----------
v2 -> v3
v2: https://lore.kernel.org/bpf/20260609093719.2858096-1-memxor@gmail.com

 * Replace bpf_obj_cancel_fields() to use bpf_map_free_internal_structs(). (Mykyta)
 * Fix CI failures.

v1 -> v2
v1: https://lore.kernel.org/bpf/20260608144841.1732406-1-memxor@gmail.com

 * Drop is_tracing_prog_type() fix due to compat breakage, revisit separately.
 * Rework bpf_obj_drop() fix to additionally reject non-iter tracing progs.
====================

Link: https://patch.msgid.link/20260609202548.3571690-1-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Alexei Starovoitov 2026-06-09 21:23:12 -07:00

parent 140fa23df9 2e7c6cb4d8

commit 1fed2e47fa

16 changed files with 421 additions and 61 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

30

include/linux/bpf.h

View file

8

kernel/bpf/arraymap.c

View file

32

kernel/bpf/hashtab.c

View file

5

kernel/bpf/syscall.c

View file

17

kernel/bpf/verifier.c

View file

4

tools/testing/selftests/bpf/prog_tests/htab_update.c

View file

33

tools/testing/selftests/bpf/prog_tests/linked_list.c

View file

66

tools/testing/selftests/bpf/prog_tests/map_kptr.c

View file

8

tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c

View file

42

tools/testing/selftests/bpf/prog_tests/task_kfunc.c

View file

4

tools/testing/selftests/bpf/progs/htab_update.c

View file

71

tools/testing/selftests/bpf/progs/linked_list.c

View file

89

tools/testing/selftests/bpf/progs/map_kptr.c

View file

20

tools/testing/selftests/bpf/progs/refcounted_kptr.c

View file

40

tools/testing/selftests/bpf/progs/task_kfunc_failure.c

View file

13

tools/testing/selftests/bpf/progs/task_kfunc_success.c

View file